xrp2x[.]world

Analysis of the domain xrp2x.world, observed on July 25, 2026, classifies it as a crypto‑related phishing site. The authoritative nameservers candy.ns.cloudflare.com and remy.ns.cloudflare.com resolve the domain to the Cloudflare edge address 172.67.177.233, which is registered to AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented; HTTP requests receive a 404 Not Found page title, indicating that the malicious landing page is no longer publicly reachable. VirusTotal reports that seven of ninety‑five scanning engines have flagged the domain, and the domain appears on a single public blocklist as well as in one AlienVault OTX pulse. Independent reputation services assign a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment.

The domain is listed as blocked by PhishDestroy and its current status is recorded as offline. The available evidence confirms that the infrastructure is hosted behind Cloudflare, leveraging its CDN and DNS services to obscure the origin of any payload. The lack of an SSL certificate suggests that the site either never deployed HTTPS or that the certificate was removed prior to takedown. The 404 response prevents direct inspection of the content, so the exact phishing lure, credential‑stealing forms, or malicious scripts remain unknown.

Nonetheless, the classification as a crypto scam indicates that the site likely attempted to lure victims into cryptocurrency transactions or wallet credential theft. Defenders should continue to block the domain and its resolved IP address at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any re‑registration of the same second‑level name or similar patterns using the same Cloudflare nameservers. Threat‑intel feeds that reference the OTX pulse and the PhishDestroy blocklist should be consulted for any updates.